A newly discovered variant of the TrickBot malware has been observed using DNS tunnelling for command and control while hiding its configuration in NTFS Alternate Data Streams, according to analysis from FortiGuard Labs. Fortinet's research shows the malware communicates with its operators by embedding encrypted data in seemingly normal DNS queries, allowing it to blend with legitimate traffic.
The variant stores its configuration and payloads inside Alternate Data Streams of NTFS files, a technique that lets it remain invisible to standard file scans. Six distinct samples were examined, all sharing similar portable executable characteristics and behaviours such as process injection and arbitrary shell command execution. No common vulnerabilities and exposures identifiers have been assigned to this activity.
Persistence is achieved through scheduled tasks that masquerade as legitimate system updates, ensuring the malware survives reboots and user logoffs. Researchers noted the malware’s modular design enables it to download additional payloads or exfiltrate stolen data via the same DNS channel. These capabilities make the threat particularly stealthy and difficult to detect with traditional signature‑based tools.
The malware was first seen on 22 July 2026 and last observed on 29 July 2026, indicating a short‑lived but active campaign during that window. No specific threat actor has been linked to the samples, though the tactics show a clear evolution from earlier TrickBot versions that relied on HTTP‑based command and control. This shift underscores the malware’s continued adaptability despite previous law‑enforcement takedowns.
The move to DNS tunnelling reflects a broader trend among threat actors seeking to bypass network monitoring that focuses on unusual web traffic. By abusing a protocol that is typically allowed outbound, the variant can operate in environments where HTTP or HTTPS connections are heavily inspected or blocked. Security teams should therefore reconsider reliance on port‑based allowlists and consider behavioural analysis of DNS traffic.
Defenders are advised to scrutinise DNS logs for anomalies such as unusually long subdomains, high query volumes to uncommon domains, or patterns that match known tunnelling signatures. Examining file systems for unexpected Alternate Data Streams, especially on executables or DLLs, can reveal hidden configurations. Additionally, reviewing scheduled tasks for newly created entries with names resembling legitimate updates helps identify persistence mechanisms.
Limiting DNS resolution to internal, trusted resolvers and enforcing strict outbound filtering can reduce the chances of successful exfiltration. Keeping endpoint protection up to date, deploying network‑based intrusion detection systems tuned for DNS abuse, and conducting regular threat‑hunting exercises further improve the odds of catching this variant before it causes damage.